Packets Don t Lie: What s Really Happening on Your Network?

Transcription

1 Packets Don t Lie: What s Really Happening on Your Network? Sponsored by LogRhythm

2 Today s Speakers Dave Shackleford SANS Analyst and Instructor Rob McGovern LogRhythm Senior Technical Product Manager

3 Introduction When it comes to detection and response, defenders require full visibility into what's traversing their network. We reviewed LogRhythm's Network Monitor Freemium, and focused on: Usability Accurate traffic identification and profiling Detection of patterns and drilling into sources Sensitive data identification and data loss prevention Network forensics Full packet capture and file reconstruction

4 Starting Out: The Test Environment A convenient and simple web interface Updates every 30 seconds Shows the last 15 minutes of activity (by default)

5 Drilling into traffic We easily drilled into traffic in the main dashboard:

6 Performing Simple Queries Query entered: DestIP: [ to ]

7 Traffic Identification & Profiling

8 Full Packet Capture Capturing and downloading PCAP files can help with network forensics. File reconstruction can also be very useful.

9 Use Case 1: Bandwidth Use Looking for Pandora

10 Use Case 1: Bandwidth Use Top bandwidth consumers:

11 Use Case 1: Bandwidth Use Lots of YouTube:

12 Use Case 1: Bandwidth Use Deep Packet Analysis (DPA) Rules:

13 Use Case 1: Bandwidth Use PCAP replay was handy for testing rules in our test cycle. We loaded some YouTube traffic that was available for replay and launched it through NetMon. This traffic then immediately triggered in the Alarms dashboard with alerts from the youtube outgoing rule.

14 Use Case 2: Network Malware Indicators Our second case involved looking for port and protocol misuse as indicators of malware traffic and command and control (C2) activity. We started with the Destination Ports dashboard. In our review environment, we saw a majority of traffic by session count appeared to be DNS, quite a bit of HTTP and HTTPS, and a fair amount of Kerberos traffic.

15 Use Case 2: Network Malware Indicators The Destination Ports dashboard:

16 Use Case 2: Network Malware Indicators We filtered on port 53:

17 Use Case 2: Network Malware Indicators Kerberos? Who s talking?

18 Use Case 2: Network Malware Indicators Unusual Traffic Spikes:

19 Use Case 2: Network Malware Indicators Port and Protocol Mismatches:

20 Use Case 3: Sensitive Data Identification NetMon Freemium includes numerous DPA rules for sensitive data identification. The first rule we looked at was monitoring for payment card data.

21 Use Case 3: Sensitive Data Identification Payment Card Data Alarm Details:

22 Conclusion To prevent network attacks and to minimize exposure time, security professionals need: Tools that are easier to use More visibility into network traffic Faster insight into network traffic LogRhythm NetMon Freemium lives up to that promise, and security operations teams should be able to hit the ground running with this solution.

23 Network Monitor Freemium Real-Time Network Visibility

24 Network Monitor in Action

25 For how-to videos, guides, and forums visit our Network Monitor Community: networkmonitor.logrhythm.com

26 Q & A Please use GoToWebinar s Questions tool to submit questions to our panel. Send to Organizers and tell us if it s for a specific panelist.

27 Acknowledgements Thanks to our sponsor: To our special guest: Rob McGovern And to our attendees, Thank you for joining us today